WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2003-01-31✕
Overview 1,892 matches · 16 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 75 EPSS ≥ 0.5
1,892matches 16in Waratek scope0.8% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 75EPSS ≥ 0.54.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 16 0.8% No exploit published 0 0.0% Outside Waratek scope 10 0.5% Not applicable 1,862 98.4% Withdrawn CVE 4 0.2%
Critical 12 0.6% High 928 49.0% Medium 819 43.3% Low 129 6.8% None 0 0.0% Unknown 4 0.2%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 1,892 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1,892 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 545 / year
Withdrawn CVE: 4Not applicable: 1,862Outside Waratek scope: 10Mitigation candidate: 16 Unknown: 4Low: 129Medium: 819High: 928Critical: 12 not blocked: 1,892 Working exploit published: 1,892
19881 Not applicable1 High1 not blocked1 Working exploit published1 19890 19901 Not applicable1 Medium1 not blocked1 Working exploit published1 19912 Not applicable2 High2 not blocked2 Working exploit published2 19920 19930 19946 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published6 19955 Not applicable5 Critical1 High2 Medium2 not blocked5 Working exploit published5 199618 Not applicable17 Withdrawn CVE1 High12 Medium5 Unknown1 not blocked18 Working exploit published18 199773 Not applicable73 High51 Medium18 Low4 not blocked73 Working exploit published73 199850 Not applicable50 Critical1 High33 Medium11 Low5 not blocked50 Working exploit published50 1999282 Outside Waratek scope1 Not applicable280 Withdrawn CVE1 Critical2 High132 Medium119 Low28 Unknown1 not blocked282 Working exploit published282 2000427 Mitigation candidate6 Outside Waratek scope1 Not applicable420 Critical1 High197 Medium195 Low34 not blocked427 Working exploit published427 2001480 Mitigation candidate2 Outside Waratek scope4 Not applicable474 Critical4 High219 Medium219 Low38 not blocked480 Working exploit published480 2002545 Mitigation candidate8 Outside Waratek scope4 Not applicable531 Withdrawn CVE2 Critical3 High276 Medium246 Low18 Unknown2 not blocked545 Working exploit published545 20032 Not applicable2 Medium1 Low1 not blocked2 Working exploit published2
19891991199319951997199920012003
1,892 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 19 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2003-0001 Medium 2003-01-17 Not applicable Working exploit published Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.
CVE-2003-1071 Low 2003-01-03 Not applicable Working exploit published rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.
CVE-2002-2425 High 2002-12-31 Not applicable Working exploit published Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin via a direct request.
CVE-2002-2424 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag.
CVE-2002-2422 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to inject arbitrary web script or HTML via a URL, which inserts the script into the resulting error message.
CVE-2002-2420 High 2002-12-31 Not applicable Working exploit published site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
CVE-2002-2417 High 2002-12-31 Not applicable Working exploit published acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges.
CVE-2002-2416 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request.
CVE-2002-2404 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110).
CVE-2002-2403 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences.
CVE-2002-2400 High 2002-12-31 Not applicable Working exploit published Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP POST request.
CVE-2002-2399 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2002-2385 High 2002-12-31 Not applicable Working exploit published Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number.
CVE-2002-2379 High 2002-12-31 Not applicable Working exploit published Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor
CVE-2002-2376 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives, web script, and HTML via the (1) full name, (2) email, (3) homepage, and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605.
CVE-2002-2370 Medium 2002-12-31 Not applicable Working exploit published SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline.
CVE-2002-2362 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter.
CVE-2002-2360 High 2002-12-31 Not applicable Working exploit published The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.
CVE-2002-2359 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL.
CVE-2002-2358 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitrary web script or HTML via the title tag of an FTP URL.
CVE-2002-2357 Medium 2002-12-31 Not applicable Working exploit published MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow.
CVE-2002-2353 Medium 2002-12-31 Not applicable Working exploit published tftpd32 2.50 and 2.50.2 allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests.
CVE-2002-2351 Medium 2002-12-31 Not applicable Working exploit published Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing "." (dot).
CVE-2002-2349 Medium 2002-12-31 Not applicable Working exploit published phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information.
CVE-2002-2348 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the command parameter.
CVE-2002-2343 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages.
CVE-2002-2341 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL.
CVE-2002-2339 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, and (6) img=left tags.
CVE-2002-2338 Medium 2002-12-31 Not applicable Working exploit published The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline, which is interpreted as the end of the message.
CVE-2002-2336 Medium 2002-12-31 Not applicable Working exploit published Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2002-2335 Medium 2002-12-31 Not applicable Working exploit published Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php.
CVE-2002-2325 High 2002-12-31 Not applicable Working exploit published The c-client library in Internet Message Access Protocol (IMAP) dated before 2002 RC2, as used by Pine 4.20 through 4.44, allows remote attackers to cause a denial of service (client crash) via a MIME-encoded email with Content-Type header containing an empty boundary field.
CVE-2002-2321 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in (1) showcat.php and (2) addyoursite.php in phpLinkat 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the catid parameter.
CVE-2002-2319 High 2002-12-31 Not applicable Working exploit published Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN, (2) DATA, and (3) MESS parameters, which are inserted into news.php3.
CVE-2002-2318 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Falcon web server 2.0.0.1009 through 2.0.0.1021 allows remote attackers to inject arbitrary web script or HTML via the URI, which is inserted into 301 error messages and executed by 404 error messages.
CVE-2002-2315 High 2002-12-31 Not applicable Working exploit published Cisco IOS 11.2.x and 12.0.x does not limit the size of its redirect table, which allows remote attackers to cause a denial of service (memory consumption) via spoofed ICMP redirect packets to the router.
CVE-2002-2314 Medium 2002-12-31 Not applicable Working exploit published Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail.
CVE-2002-2312 Medium 2002-12-31 Not applicable Working exploit published Opera 6.0.1 allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage.
CVE-2002-2309 High 2002-12-31 Not applicable Working exploit published php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
CVE-2002-2306 High 2002-12-31 Not applicable Working exploit published Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages.
CVE-2002-2304 High 2002-12-31 Not applicable Working exploit published SQL injection vulnerability in admin/auth/checksession.php in MyPHPLinks 2.1.9 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the idsession parameter.
CVE-2002-2300 High 2002-12-31 Not applicable Working exploit published Buffer overflow in ftpd 5.4 in 3Com NBX 4.0.17 or ftpd 5.4.2 in 3Com NBX 4.1.4 allows remote attackers to cause a denial of service (crash) via a long CEL command.
CVE-2002-2298 Medium 2002-12-31 Not applicable Working exploit published PHP remote file inclusion vulnerability in config.php in Thatware 0.3 through 0.5.3 allows remote attackers to execute arbitrary PHP code via the root_path parameter.
CVE-2002-2296 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in YaBB.pl in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 allows remote attackers to inject arbitrary web script or HTML via the num parameter.
CVE-2002-2295 High 2002-12-31 Not applicable Working exploit published Buffer overflow in Pico Server (pServ) 2.0 beta 1 through beta 5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a 1024-byte TCP stream message, which triggers an off-by-one buffer overflow, or (2) a long method name in an HTTP request, (3) a long version number in an HTTP request, (4) a long User-Agent header, or (5) a long file path.
CVE-2002-2288 Medium 2002-12-31 Not applicable Working exploit published Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message.
CVE-2002-2287 High 2002-12-31 Not applicable Working exploit published PHP remote file inclusion vulnerability in quick_reply.php for phpBB Advanced Quick Reply Hack 1.0.0 and 1.1.0 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.
CVE-2002-2281 High 2002-12-31 Not applicable Working exploit published Symantec Java! JIT (Just-In-Time) Compiler for Netscape Communicator 4.0 through 4.8 allows remote attackers to execute arbitrary Java commands via an applet that uses a jump call, which is not correctly compiled by the JIT compiler.
CVE-2002-2272 High 2002-12-31 Mitigation candidate Working exploit published Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
CVE-2002-2268 High 2002-12-31 Not applicable Working exploit published Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.
CVE-2002-2258 Medium 2002-12-31 Not applicable Working exploit published Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value in the Content-Length header, which causes an access violation after a failed atoi function call.
CVE-2002-2255 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in searchuser mode.
CVE-2002-2251 High 2002-12-31 Not applicable Working exploit published Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument.
CVE-2002-2249 High 2002-12-31 Not applicable Working exploit published PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to (1) backend.php, (2) screen.php, or (3) admin/modules/comment.php.
CVE-2002-2247 Medium 2002-12-31 Not applicable Working exploit published The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive information such as the full web root path via phpinfo.php, which calls the phpinfo function.
CVE-2002-2246 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML via the HTTP referer header (HTTP_REFERER) to a non-existent page, which is injected into the resulting 404 error page.
CVE-2002-2235 Medium 2002-12-31 Not applicable Working exploit published member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.
CVE-2002-2232 High 2002-12-31 Not applicable Working exploit published Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.
CVE-2002-2226 High 2002-12-31 Not applicable Working exploit published Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.
CVE-2002-2219 High 2002-12-31 Not applicable Working exploit published chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user (userid) field.
CVE-2002-2200 High 2002-12-31 Not applicable Working exploit published Benjamin Lefevre Dobermann FORUM 0.5 and earlier allows remote attackers to remotely include and execute malicious PHP files via the "subpath" variablein (1) entete.php, (2) enteteacceuil.php, (3) index.php, or (4) newtopic.php.
CVE-2002-2195 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in the version update check for Winamp 2.80 and earlier allows remote attackers who can spoof www.winamp.com to execute arbitrary code via a long server response.
CVE-2002-2193 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in mojo.cgi for Mojo Mail 2.7 allows remote attackers to inject arbitrary web script via the email parameter.
CVE-2002-2192 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Perception LiteServe 2.0.1 allows remote attackers to execute arbitrary web script via (1) a Host: header when DNS wildcards are supported or (2) the query string in a "dir" request to indexed folders.
CVE-2002-2191 Medium 2002-12-31 Not applicable Working exploit published Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option, allows remote attackers to obtain potential sensitive information such as the version via a request for a non-existent .nsf database, which leaks the version in the HTTP banner.
CVE-2002-2190 High 2002-12-31 Not applicable Working exploit published ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file.
CVE-2002-2178 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript script via the sid parameter, as demonstrated using an IMG tag.
CVE-2002-2176 High 2002-12-31 Not applicable Working exploit published SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the user_level parameter in the User Profile page.
CVE-2002-2174 Medium 2002-12-31 Not applicable Working exploit published The Telnet proxy of 602Pro LAN SUITE 2002 does not restrict the number of outstanding connections to the local host, which allows remote attackers to create a denial of service (memory consumption) via a large number of connections.
CVE-2002-2171 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in acWEB 1.8 and 1.14 allows remote attackers to insert arbitrary HTML and web script via a URL, possibly via a "%db" request in a URL.
CVE-2002-2170 High 2002-12-31 Not applicable Working exploit published Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request that accesses the dir.hts page on the localhost and adds an entire hard drive to be shared.
CVE-2002-2169 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting vulnerability AOL Instant Messenger (AIM) 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthorized activities, such as adding buddies and groups to a user's buddy list, via a URL with a META HTTP-EQUIV="refresh" tag to an aim: URL.
CVE-2002-2165 Low 2002-12-31 Not applicable Working exploit published The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox.
CVE-2002-2164 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link.
CVE-2002-2162 Medium 2002-12-31 Not applicable Working exploit published Cerulean Studios Trillian 0.73 and earlier use weak encrypttion (XOR) for storing user passwords in .ini files in the Trillian directory, which allows local users to gain access to other user accounts.
CVE-2002-2154 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences.
CVE-2002-2149 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in Lucent Access Point 300, 600, and 1500 Service Routers allows remote attackers to cause a denial of service (reboot) via a long HTTP request to the administrative interface.
CVE-2002-2145 High 2002-12-31 Not applicable Working exploit published Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
CVE-2002-2143 High 2002-12-31 Not applicable Working exploit published The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized access to the web server by viewing the source of admin.html.
CVE-2002-2134 Medium 2002-12-31 Not applicable Working exploit published haut.php in PEEL 1.0b allows remote attackers to execute arbitrary PHP code by modifying the dirroot parameter to reference a URL on a remote web server that contains the code in a lang.php file.
CVE-2002-2129 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting vulnerability (XSS) in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form.
CVE-2002-2113 High 2002-12-31 Not applicable Working exploit published search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.
CVE-2002-2106 High 2002-12-31 Not applicable Working exploit published PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variable, as demonstrated using conflict.php.
CVE-2002-2105 Low 2002-12-31 Not applicable Working exploit published Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
CVE-2002-2087 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in Borland InterBase 6.0 allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_drop, (2) gds_lock_mgr, or (3) gds_inet_server.
CVE-2002-2084 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) l and (2) topic parameters.
CVE-2002-2073 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
CVE-2002-2072 Medium 2002-12-31 Mitigation candidate Working exploit published java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.
CVE-2002-2071 Medium 2002-12-31 Not applicable Working exploit published Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet, (2) FTP, (3) ypbind, (4) rpc.lockd, (5) snmp, (6) ttdbserverd, and possibly other services via a TCP SYN scan, as demonstrated using nmap.
CVE-2002-2062 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
CVE-2002-2055 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVE-2002-2042 High 2002-12-31 Not applicable Working exploit published ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes, which could allow local users to execute arbitrary code by modifying running processes.
CVE-2002-2041 High 2002-12-31 Not applicable Working exploit published Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
CVE-2002-2040 High 2002-12-31 Not applicable Working exploit published The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
CVE-2002-2039 Low 2002-12-31 Not applicable Working exploit published /bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
CVE-2002-2032 Medium 2002-12-31 Not applicable Working exploit published sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.
CVE-2002-2031 Medium 2002-12-31 Not applicable Working exploit published Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.
CVE-2002-2029 High 2002-12-31 Not applicable Working exploit published PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
CVE-2002-2026 High 2002-12-31 Not applicable Working exploit published Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP "220" message reply.
CVE-2002-2021 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
‹ prev page 1 of 19 next ›